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DETAILED ACTION 

1. Claims 1-28 are pending in this application. 

Claim Objections 

2. Claims 1 is objected to because of the following informalities: 

a. It recites limitation "a count value" in line 7. It's not clear if this limitation is 
same as "a count value" of line 4. 

b. It recites limitation "a selected table entry" in line 7. Its not clear if this limitation 
is same as "a first table entry" of line 4. 

c. It recites limitation "the metric" in line 12. It's not clear if this limitation is same 
as "a metric value" of line 12. 

Appropriate correction and/or clarification required. 

3. Claim 17 is objected to because it recites "a event" in line 2. 
Appropriate correction and/or clarification required. 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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5. Claims 1-2, 4, 10-15, 17-18, 20 and 25-28 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over Powers et al. (Patent No.: US 6,832,086 B1), hereinafter 
"Powers" in view of Teague (Pub. No.: US 2003/0229717 A1) and further in view of 
MeLampy et al. (US 7,002,973 B2), hereinafter "MeLampy". 

6. As to claim 1, Powers discloses a method of identifying service abuse, 
comprising: receiving an event requesting a service (column 3, lines 5-26, "...receives 
event notifications.."); creating an event identification associated with the event (column 
4, lines 40-65, "...creation of an event object"); incrementing a count value of a first 
table entry of a plurality of table entries in a screening table in response to the event 
identification matching an event identification associated with the screening table entry 
(column 5, lines 1-25, "The event counter module 54 increments the counter...."); and 
determining a metric value for the event from the screening table, the metric indicating 
that the event is an abusive request (column 5, lines 1-25, "...determine whether the 
filtered event exceeds the threshold. If the event count exceeds the filtered event 
exceeds the threshold, an alarm is emitted to the manager 42."). 

Powers doesn't explicitly disclose decrementing a count value of a selected table 
entry of the plurality of table entries in response to the event identification failing to 
match an event identification associated with the selected table entry; replacing the 
selected table entry with the event identification associated with the event in response 
to the count of value of the selected entry equaling zero; 
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However, Teague discloses decrementing a count value of a selected table entry 
of the plurality of table entries in response to the event identification failing to match an 
event identification associated with the selected table entry ([0063], "decrements the 
counter after a message has been accepted"). 

Therefore, it would have been obvious to one of the ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers as taught by Teague 
in order to reduce spamming by limiting the number of messages. 

Neither Powers nor Teague explicitly discloses replacing the selected table entry 
with the event identification associated with the event in response to the count of value 
of the selected entry equaling zero. However, MeLampy discloses replacing the 
selected table entry with the event identification associated with the event in response 
to the count of value of the selected entry equaling zero ("...the entries that are no 
longer required are removed/replaced by the newer entry"). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers and Teague as taught 
by MeLampy in order to allocate the resources effectively by minimizing the resourced 
used. 

7. As to claim 15, it is rejected using the same rationale as for the rejection of claim 
1. 
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8. As to claim 17, Powers discloses wherein each event packet includes an event 
identification associated with an event (column 4, lines 40-65, "...creation of an event 
object"). 

9. As to claims 2 and 18, Power discloses wherein the event identification 
corresponds with the identity of a user (column 4, lines 40-65). 

10. As to claims 4 and 20, Power discloses wherein the event identification includes 
a user identification (column 4, lines 40-65). 

11. As to claim 10, Powers disclose further including disregarding the event in 
response to the metric value crossing a threshold value (column 5, lines 1-25). 

12. As to claim 1 1 , Powers discloses further including terminating a connection used 
to receive the event in response to the metric value crossing a threshold value (column 
5, lines 1-25). 

13. As to claim 12, Powers discloses further including returning an error message in 
response to the event in response to the metric value crossing a threshold value 
(column 5, lines 1-25). 
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14. As to claim 25, Power discloses wherein the cluster host is further adapted to 
determine a metric value for an entry of the master screening table, the metric indicating 
that the entry of the master screening table corresponds to an abusive request (column 
5, lines 1-25, "...determine whether the filtered event exceeds the threshold. If the event 
count exceeds the filtered event exceeds the threshold, an alarm is emitted to the 
manager 42."). 

1 5. As to claim 26, Powers discloses wherein the cluster host is further adapted to 
set a block value associated with the entry in response to the metric value (column 5, 
lines 1-25) 

16. As to claims 13 and 27, Powers discloses further including: determining an 
average metric value from the metric value and a set of previous metric values; and 
disregarding the event in response to the average metric value crossing a threshold 
value (column 5, lines 1-25) 

17. As to claims 14 and 28, Powers disclose wherein determining a metric value 
comprises: determining a first sub-metric value from the screening table; determining a 
second sub-metric value from a second screening table; determining the metric value 
from a weighted combination of the first and second sub-metric values (column 5, lines 
1-25). 



Application/Control Number: 10/803,473 Page 7 

Art Unit: 2135 

18. Claims 8 and 9 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Powers in view of Teague in view of MeLampy and further in view of Narad et al. (Pub. 
No.: US 2003/0061332 A1), hereinafter "Narad". 

19. As to claim 8, Neither Powers and Teague nor MeLampy explicitly disclose 
further including: selecting a second table entry as a new selected table entry in 
response to receiving the event However, Narad discloses disclose further including: 
selecting a second table entry as a new selected table entry in response to receiving the 
event ([0411], "...pointer can be used to speculatively fetch the next record.."). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, Teague and 
MeLampy as taught by Narad in order to minimize the memory latency. 

20. As to claim 9, it is rejected using the same rationale as for the rejection of claim 
8. 

21. Claims 3, 5-7, 19 and 21-24 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Powers in view of Teague in view of MeLampy and further in view of 
Brothers (Pub. No.: US 2002/0083178 A1). 
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22. As to claims 3 and 19, Neither Powers and Teague nor MeLampy explicitly 
discloses wherein the event identification includes an IP address. However, Brothers 
discloses wherein the event identification includes an IP address (FIG. 9C). 

Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Powers, Teague and MeLampy as 
taught by Brothers in order to support TCP/IP protocol which is commonly used to 
transmit data over networks. 

23. As to claims 5 and 21, Neither Powers and Teague nor MeLampy explicitly 
discloses wherein the event identification corresponds with a content value included in 
the event. However, Brother discloses wherein the event identification corresponds with 
a content value included in the event ([0020] - [0021], "secure content"). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, Teague and 
MeLampy as taught by Brothers in order to support various functionality as well as 
maintaining the security. 

24. As to claims 6 and 22, Neither Powers and Teague nor MeLampy explicitly 
discloses wherein the content value includes at least a portion of a message. However, 
Brother discloses wherein the content value includes at least a portion of a message 
([0020] - [0021], "secure content"). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, Teague and 
MeLampy as taught by Brothers in order to support various functionality as well as 
maintaining the security. 

25. As to claims 7 and 23, Neither Powers and Teague nor MeLampy explicitly 
discloses wherein the content value includes at least a portion of a URL. However, 
Brothers discloses wherein the content value includes at least a portion of a URL 
([0020] -[0021]). 

Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Powers, Teague and MeLampy as 
taught by Brothers in order to support TCP/IP protocol which is commonly used to 
transmit data over networks. 

26. As to claim 24, Neither Powers and Teague nor MeLampy explicitly discloses 
wherein the content value is a hash of the content value included in the event. However, 
Brothers disclose wherein the content value is a hash of the content value included in 
the event ([0020] - [0021]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, Teague and 
MeLampy as taught by Brothers in order to support various functionality as well as 
maintaining the security. 
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27. Claim 16 rejected under 35 U.S.C. 103(a) as being unpatentable over Powers in 
view of Teague in view of MeLampy and further in view of Fisherman et al. (Patent 
Number 5,586,301), hereinafter "Fisherman". 

28. As to claim 16, Neither Powers and Teague nor MeLampy explicitly disclose 
wherein the local screening table is a copy of the master screening table. However, 
Fisherman discloses wherein the local screening table is a copy of the master screening 
table (column 7, lines 20-40, "...the corresponding changes are made in the main file 
allocation table (MAINFAT) and in the cluster affiliation table"). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, Teague and 
MeLampy as taught by Fisherman in order to minimize the transaction time. 

Conclusion 

29. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Suman Debnath whose telephone number is 571 270 
1256. The examiner can normally be reached on 8 am to 5 pm. 

30. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on 571 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 



Application/Control Number: 10/803,473 



Page 1 1 



Art Unit: 2135 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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